summarylogtreecommitdiffstats
diff options
context:
space:
mode:
authorJan Cholasta2015-06-02 07:44:05 +0200
committerJan Cholasta2015-06-02 07:44:05 +0200
commit090d2aac3e33f10f0039bf3b950e149523ccb9a2 (patch)
tree42e04f722e115fd71173f4e671009fac2f9e586c
downloadaur-090d2aac3e33f10f0039bf3b950e149523ccb9a2.tar.gz
Initial commit
-rw-r--r--.SRCINFO85
-rw-r--r--0001-Use-Arch-Linux-Paths.patch454
-rw-r--r--0002-Add-Arch-Linux-Platform.patch151
-rw-r--r--0003-Use-Python-2.patch657
-rw-r--r--0004-NTP-Fixes.patch38
-rw-r--r--0005-Fix-nss-includes.patch40
-rw-r--r--0006-Disable-make-testcert.patch24
-rw-r--r--0007-Fix-nosetests-path.patch25
-rw-r--r--PKGBUILD348
-rw-r--r--install.freeipa47
-rw-r--r--install.freeipa-server34
-rwxr-xr-xsss-auth-setup.py338
12 files changed, 2241 insertions, 0 deletions
diff --git a/.SRCINFO b/.SRCINFO
new file mode 100644
index 00000000000..6bc1dd085b5
--- /dev/null
+++ b/.SRCINFO
@@ -0,0 +1,85 @@
+pkgbase = freeipa
+ pkgdesc = The Identity, Policy, and Audit system
+ pkgver = 3.3.5
+ pkgrel = 1
+ url = http://www.freeipa.org/
+ arch = i686
+ arch = x86_64
+ license = GPL
+ checkdepends = check
+ checkdepends = python2-nose
+ makedepends = curl
+ makedepends = java-runtime>=7
+ makedepends = krb5
+ makedepends = libunistring
+ makedepends = nspr
+ makedepends = nss
+ makedepends = openssl
+ makedepends = openldap
+ makedepends = popt
+ makedepends = python2
+ makedepends = python2-distribute
+ makedepends = python2-dnspython
+ makedepends = python2-kerberos
+ makedepends = python2-krbv
+ makedepends = python2-ldap
+ makedepends = python2-lxml
+ makedepends = python2-memcached
+ makedepends = python2-m2crypto
+ makedepends = python2-netaddr
+ makedepends = python2-nss
+ makedepends = python2-polib
+ makedepends = python2-pyasn1
+ makedepends = python2-pylint
+ makedepends = python2-pyopenssl
+ makedepends = sssd
+ makedepends = xmlrpc-c
+ options = !libtool
+ source = http://www.freeipa.org/downloads/src/freeipa-3.3.5.tar.gz
+ source = sss-auth-setup.py
+ source = 0001-Use-Arch-Linux-Paths.patch
+ source = 0002-Add-Arch-Linux-Platform.patch
+ source = 0003-Use-Python-2.patch
+ source = 0004-NTP-Fixes.patch
+ source = 0005-Fix-nss-includes.patch
+ source = 0006-Disable-make-testcert.patch
+ source = 0007-Fix-nosetests-path.patch
+ sha512sums = 58325e7a619eeb0170dd32a648f22e50c0df2d7bc0a7609b6f0be3b8328890e5e027ba094fd4970ac063544b4d163f4e07ac62c1b358dba5246e148c2fd830b6
+ sha512sums = 5f101692e311205b3706642c6f329459646aaa693683ab2d4847bd8a7f464ef99ec617b0422df8e25ec2a0dc3a68cd9bf54db4bb3013b84844df15160716adc8
+ sha512sums = 604927b05f248c6ee8a42c87198a3ab05aa2a98b3a8f4b9ee0352e049d9e59195eac2292b609a9f84b176875cd6640d118f7e5c35f74b042f7e03561aafd2c04
+ sha512sums = 7bd0dba218626f27f918b9cf15cf25183a90421ee2c792648f36e6cd75cf09f2ff04e30a9419f6033aa4d640fc1f7dcfa973fec9fc2c74354bb1e609621d449b
+ sha512sums = 872a172451c436fc916b72bc48733905b4f9298ece39ad737f60790e9fe2da896dfd2255f58d7aeb301c9c19a2bb2078684ca8449f9dec5dcb45fc1f5bda7b30
+ sha512sums = a70bcc98ea71e8154e7600d6bf7ed8de6bbb73d31b5ccb0b556a538e9cce78fbd71698e3be6cfa33487226e0e79d6fb8ee78d926259a4543fe4300a6b90b9a09
+ sha512sums = 294a6e3a09cada150dd0f21c712f312840a882acb067520b70ebd058cd4ee88863a2a828df63efc190c5608ffb0d71d60253883baddeb7487aec7b3d905abb04
+ sha512sums = 5bc0afc21a9a178ace728f902422683502b6cf579585bc8feab42d1f7701e8609468e92265b22c7f1f958f0f175f3287ea011e8f149fb30b231708e15b6eefd2
+ sha512sums = 0a79540e0df4e7b0fed8fd378411799fc5b2152795e1938df2ee6935e944517cd8c780740e8aec2f718476f3b5bd0a36113b85add04d4bdb180da5ba80c37c50
+
+pkgname = freeipa
+ install = install.freeipa
+ depends = autofs
+ depends = bind
+ depends = certmonger
+ depends = curl
+ depends = cyrus-sasl-gssapi
+ depends = gnupg
+ depends = iproute2
+ depends = nfs-utils
+ depends = nfsidmap
+ depends = nss
+ depends = ntp
+ depends = oddjob
+ depends = pam-krb5
+ depends = python2-dnspython
+ depends = python2-kerberos
+ depends = python2-krbv
+ depends = python2-ldap
+ depends = python2-lxml
+ depends = python2-netaddr
+ depends = python2-nss
+ depends = python2-pyopenssl
+ depends = sssd
+ depends = wget
+ depends = xmlrpc-c
+ backup = etc/ipa/default.conf
+ backup = etc/ipa/ca.crt
+
diff --git a/0001-Use-Arch-Linux-Paths.patch b/0001-Use-Arch-Linux-Paths.patch
new file mode 100644
index 00000000000..c519500596d
--- /dev/null
+++ b/0001-Use-Arch-Linux-Paths.patch
@@ -0,0 +1,454 @@
+From ba36f963a8eac68990459b1e5fc54413584b4fd1 Mon Sep 17 00:00:00 2001
+From: Xiao-Long Chen <chenxiaolong@cxl.epac.to>
+Date: Wed, 16 Apr 2014 19:31:08 -0400
+Subject: [PATCH 1/7] Use Arch Linux Paths
+
+---
+ init/systemd/ipa_memcached.service | 2 +-
+ install/conf/ca_renewal | 2 +-
+ install/conf/ipa.conf | 2 +-
+ install/tools/ipa-upgradeconfig | 10 +++++-----
+ install/tools/man/ipa-upgradeconfig.8 | 2 +-
+ ipa-client/ipa-install/ipa-client-automount | 4 ++--
+ ipa-client/ipa-install/ipa-client-install | 2 +-
+ ipa-client/ipaclient/ntpconf.py | 2 +-
+ ipa-client/man/ipa-client-automount.1 | 4 ++--
+ ipa-client/man/ipa-client-install.1 | 2 +-
+ ipapython/certmonger.py | 2 +-
+ ipapython/platform/base/systemd.py | 22 +++++++++++-----------
+ ipaserver/install/cainstance.py | 2 +-
+ ipaserver/install/httpinstance.py | 26 +++++++++++++-------------
+ ipaserver/install/ipa_backup.py | 10 +++++-----
+ ipaserver/install/ntpinstance.py | 6 +++---
+ 16 files changed, 50 insertions(+), 50 deletions(-)
+
+diff --git a/init/systemd/ipa_memcached.service b/init/systemd/ipa_memcached.service
+index a4857cd..2f73f39 100644
+--- a/init/systemd/ipa_memcached.service
++++ b/init/systemd/ipa_memcached.service
+@@ -4,7 +4,7 @@ After=network.target
+
+ [Service]
+ Type=forking
+-EnvironmentFile=/etc/sysconfig/ipa_memcached
++EnvironmentFile=/etc/conf.d/ipa_memcached.conf
+ PIDFile=/var/run/ipa_memcached/ipa_memcached.pid
+ ExecStart=/usr/bin/memcached -d -s $SOCKET_PATH -u $USER -m $CACHESIZE -c $MAXCONN -P /var/run/ipa_memcached/ipa_memcached.pid $OPTIONS
+
+diff --git a/install/conf/ca_renewal b/install/conf/ca_renewal
+index 57a9e9c..449e2de 100644
+--- a/install/conf/ca_renewal
++++ b/install/conf/ca_renewal
+@@ -3,4 +3,4 @@
+ id=dogtag-ipa-retrieve-agent-submit
+ ca_is_default=0
+ ca_type=EXTERNAL
+-ca_external_helper=/usr/libexec/certmonger/dogtag-ipa-retrieve-agent-submit
++ca_external_helper=/usr/lib/certmonger/certmonger/dogtag-ipa-retrieve-agent-submit
+diff --git a/install/conf/ipa.conf b/install/conf/ipa.conf
+index 1a33f62..8184f8a 100644
+--- a/install/conf/ipa.conf
++++ b/install/conf/ipa.conf
+@@ -36,7 +36,7 @@ Header unset ETag
+ FileETag None
+
+ # FIXME: WSGISocketPrefix is a server-scope directive. The mod_wsgi package
+-# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
++# should really be fixed by adding this its /etc/httpd/conf/extra/wsgi.conf:
+ WSGISocketPrefix /run/httpd/wsgi
+
+
+diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig
+index 41c5126..c565d27 100644
+--- a/install/tools/ipa-upgradeconfig
++++ b/install/tools/ipa-upgradeconfig
+@@ -112,7 +112,7 @@ def update_conf(sub_dict, filename, template_filename):
+
+ def find_hostname():
+ """Find the hostname currently configured in ipa-rewrite.conf"""
+- filename="/etc/httpd/conf.d/ipa-rewrite.conf"
++ filename="/etc/httpd/conf/extra/ipa-rewrite.conf"
+
+ if not ipautil.file_exists(filename):
+ return None
+@@ -135,7 +135,7 @@ def find_autoredirect(fqdn):
+
+ Returns True if autoredirect is enabled, False otherwise
+ """
+- filename = '/etc/httpd/conf.d/ipa-rewrite.conf'
++ filename = '/etc/httpd/conf/extra/ipa-rewrite.conf'
+ if os.path.exists(filename):
+ pattern = "^RewriteRule \^/\$ https://%s/ipa/ui \[L,NC,R=301\]" % fqdn
+ p = re.compile(pattern)
+@@ -1030,9 +1030,9 @@ def main():
+ certmap_dir = dsinstance.config_dirname(
+ dsinstance.realm_to_serverid(api.env.realm))
+
+- upgrade(sub_dict, "/etc/httpd/conf.d/ipa.conf", ipautil.SHARE_DIR + "ipa.conf")
+- upgrade(sub_dict, "/etc/httpd/conf.d/ipa-rewrite.conf", ipautil.SHARE_DIR + "ipa-rewrite.conf")
+- upgrade(sub_dict, "/etc/httpd/conf.d/ipa-pki-proxy.conf", ipautil.SHARE_DIR + "ipa-pki-proxy.conf", add=True)
++ upgrade(sub_dict, "/etc/httpd/conf/extra/ipa.conf", ipautil.SHARE_DIR + "ipa.conf")
++ upgrade(sub_dict, "/etc/httpd/conf/extra/ipa-rewrite.conf", ipautil.SHARE_DIR + "ipa-rewrite.conf")
++ upgrade(sub_dict, "/etc/httpd/conf/extra/ipa-pki-proxy.conf", ipautil.SHARE_DIR + "ipa-pki-proxy.conf", add=True)
+ if subject_base:
+ upgrade(
+ sub_dict,
+diff --git a/install/tools/man/ipa-upgradeconfig.8 b/install/tools/man/ipa-upgradeconfig.8
+index 43e2ab9..48bc1b6 100644
+--- a/install/tools/man/ipa-upgradeconfig.8
++++ b/install/tools/man/ipa-upgradeconfig.8
+@@ -24,7 +24,7 @@ ipa\-upgradeconfig
+ .SH "DESCRIPTION"
+ A tool to update the IPA Apache configuration during an upgrade.
+
+-It examines the VERSION value in the head of \fI/etc/httpd/conf.d/ipa.conf\fR and \fI/etc/httpd/conf.d/ipa\-rewrite.conf\fR and compares this with the templates. If an update is needed then new files are written.
++It examines the VERSION value in the head of \fI/etc/httpd/conf/extra/ipa.conf\fR and \fI/etc/httpd/conf/extra/ipa\-rewrite.conf\fR and compares this with the templates. If an update is needed then new files are written.
+
+ It also will convert a CA configured to be accessible via ports 9443, 9444, 9445 and 9446 to be proxied by the IPA web server on ports 80 and 443.
+
+diff --git a/ipa-client/ipa-install/ipa-client-automount b/ipa-client/ipa-install/ipa-client-automount
+index 62531bf..000de4e 100755
+--- a/ipa-client/ipa-install/ipa-client-automount
++++ b/ipa-client/ipa-install/ipa-client-automount
+@@ -39,10 +39,10 @@ from ipapython.ipa_log_manager import *
+ from ipapython.dn import DN
+ from ipapython import services as ipaservices
+
+-AUTOFS_CONF = '/etc/sysconfig/autofs'
++AUTOFS_CONF = '/etc/conf.d/autofs'
+ NSSWITCH_CONF = '/etc/nsswitch.conf'
+ AUTOFS_LDAP_AUTH = '/etc/autofs_ldap_auth.conf'
+-NFS_CONF = '/etc/sysconfig/nfs'
++NFS_CONF = '/etc/conf.d/nfs'
+ IDMAPD_CONF = '/etc/idmapd.conf'
+
+ def parse_options():
+diff --git a/ipa-client/ipa-install/ipa-client-install b/ipa-client/ipa-install/ipa-client-install
+index afed54e..0f42e4b 100755
+--- a/ipa-client/ipa-install/ipa-client-install
++++ b/ipa-client/ipa-install/ipa-client-install
+@@ -603,7 +603,7 @@ def uninstall(options, env):
+ # to this version but not unenrolled/enrolled again
+ # In such case it is OK to fail
+ restored = fstore.restore_file("/etc/ntp.conf")
+- restored |= fstore.restore_file("/etc/sysconfig/ntpd")
++ restored |= fstore.restore_file("/etc/conf.d/ntpd.conf")
+ if ntp_step_tickers:
+ restored |= fstore.restore_file("/etc/ntp/step-tickers")
+ except Exception:
+diff --git a/ipa-client/ipaclient/ntpconf.py b/ipa-client/ipaclient/ntpconf.py
+index 8c4c653..7c95a46 100644
+--- a/ipa-client/ipaclient/ntpconf.py
++++ b/ipa-client/ipaclient/ntpconf.py
+@@ -98,7 +98,7 @@ def __write_config(path, content):
+ def config_ntp(server_fqdn, fstore = None, sysstore = None):
+ path_step_tickers = "/etc/ntp/step-tickers"
+ path_ntp_conf = "/etc/ntp.conf"
+- path_ntp_sysconfig = "/etc/sysconfig/ntpd"
++ path_ntp_sysconfig = "/etc/conf.d/ntpd.conf"
+ sub_dict = { }
+ sub_dict["SERVER"] = server_fqdn
+
+diff --git a/ipa-client/man/ipa-client-automount.1 b/ipa-client/man/ipa-client-automount.1
+index 5b60503..16ccbea 100644
+--- a/ipa-client/man/ipa-client-automount.1
++++ b/ipa-client/man/ipa-client-automount.1
+@@ -29,7 +29,7 @@ The automount configuration consists of three files:
+ .IP o
+ /etc/nsswitch.conf
+ .IP o
+-/etc/sysconfig/autofs
++/etc/conf.d/autofs
+ .IP o
+ /etc/autofs_ldap_auth.conf
+
+@@ -79,7 +79,7 @@ Files that will be configured when SSSD is the automount client (default):
+ .TP
+ Files that will be configured when using the ldap automount client:
+
+-/etc/sysconfig/autofs
++/etc/conf.d/autofs
+
+ /etc/autofs_ldap_auth.conf
+
+diff --git a/ipa-client/man/ipa-client-install.1 b/ipa-client/man/ipa-client-install.1
+index 3496ee3..38df29f 100644
+--- a/ipa-client/man/ipa-client-install.1
++++ b/ipa-client/man/ipa-client-install.1
+@@ -202,7 +202,7 @@ Files that will be replaced if they exist and SSSD is not configured (\-\-no\-ss
+ Files replaced if NTP is enabled:
+
+ /etc/ntp.conf\p
+-/etc/sysconfig/ntpd\p
++/etc/conf.d/ntpd.conf\p
+ /etc/ntp/step\-tickers\p
+ .TP
+ Files always created (replacing existing content):
+diff --git a/ipapython/certmonger.py b/ipapython/certmonger.py
+index 03f4b23..7401ae0 100644
+--- a/ipapython/certmonger.py
++++ b/ipapython/certmonger.py
+@@ -298,7 +298,7 @@ def add_principal_to_cas(principal):
+ If the hostname we were passed to use in ipa-client-install doesn't
+ match the value of gethostname() then we need to append
+ -k host/HOSTNAME@REALM to the ca helper defined for
+- /usr/libexec/certmonger/ipa-submit.
++ /usr/lib/certmonger/certmonger/ipa-submit.
+
+ We also need to restore this on uninstall.
+
+diff --git a/ipapython/platform/base/systemd.py b/ipapython/platform/base/systemd.py
+index f122018..6f4f6d7 100644
+--- a/ipapython/platform/base/systemd.py
++++ b/ipapython/platform/base/systemd.py
+@@ -25,7 +25,7 @@ from ipalib import api
+
+ class SystemdService(base.PlatformService):
+ SYSTEMD_ETC_PATH = "/etc/systemd/system/"
+- SYSTEMD_LIB_PATH = "/lib/systemd/system/"
++ SYSTEMD_LIB_PATH = "/usr/lib/systemd/system/"
+ SYSTEMD_SRV_TARGET = "%s.target.wants"
+
+ def __init__(self, service_name, systemd_name):
+@@ -98,7 +98,7 @@ class SystemdService(base.PlatformService):
+
+ def stop(self, instance_name="", capture_output=True):
+ instance = self.service_instance(instance_name)
+- args = ["/bin/systemctl", "stop", instance]
++ args = ["/usr/bin/systemctl", "stop", instance]
+
+ # The --ignore-dependencies switch is used to avoid possible
+ # deadlock during the shutdown transaction. For more details, see
+@@ -116,7 +116,7 @@ class SystemdService(base.PlatformService):
+ super(SystemdService, self).stop(instance_name,update_service_list=update_service_list)
+
+ def start(self, instance_name="", capture_output=True, wait=True):
+- ipautil.run(["/bin/systemctl", "start", self.service_instance(instance_name)], capture_output=capture_output)
++ ipautil.run(["/usr/bin/systemctl", "start", self.service_instance(instance_name)], capture_output=capture_output)
+ if 'context' in api.env and api.env.context in ['ipactl', 'installer']:
+ update_service_list = True
+ else:
+@@ -128,7 +128,7 @@ class SystemdService(base.PlatformService):
+ def restart(self, instance_name="", capture_output=True, wait=True):
+ # Restart command is broken before systemd-36-3.fc16
+ # If you have older systemd version, restart of dependent services will hang systemd indefinetly
+- ipautil.run(["/bin/systemctl", "restart", self.service_instance(instance_name)], capture_output=capture_output)
++ ipautil.run(["/usr/bin/systemctl", "restart", self.service_instance(instance_name)], capture_output=capture_output)
+ if wait and self.is_running(instance_name):
+ self.__wait_for_open_ports(self.service_instance(instance_name))
+
+@@ -138,7 +138,7 @@ class SystemdService(base.PlatformService):
+ while True:
+ try:
+ (sout, serr, rcode) = ipautil.run(
+- ["/bin/systemctl", "is-active", instance],
++ ["/usr/bin/systemctl", "is-active", instance],
+ capture_output=True
+ )
+ except ipautil.CalledProcessError as e:
+@@ -158,7 +158,7 @@ class SystemdService(base.PlatformService):
+ def is_installed(self):
+ installed = True
+ try:
+- (sout,serr,rcode) = ipautil.run(["/bin/systemctl", "list-unit-files", "--full"])
++ (sout,serr,rcode) = ipautil.run(["/usr/bin/systemctl", "list-unit-files", "--full"])
+ if rcode != 0:
+ installed = False
+ else:
+@@ -173,7 +173,7 @@ class SystemdService(base.PlatformService):
+ def is_enabled(self, instance_name=""):
+ enabled = True
+ try:
+- (sout,serr,rcode) = ipautil.run(["/bin/systemctl", "is-enabled", self.service_instance(instance_name)])
++ (sout,serr,rcode) = ipautil.run(["/usr/bin/systemctl", "is-enabled", self.service_instance(instance_name)])
+ if rcode != 0:
+ enabled = False
+ except ipautil.CalledProcessError, e:
+@@ -218,7 +218,7 @@ class SystemdService(base.PlatformService):
+ # Link exists and it is broken, make new one
+ os.unlink(srv_lnk)
+ os.symlink(self.lib_path, srv_lnk)
+- ipautil.run(["/bin/systemctl", "--system", "daemon-reload"])
++ ipautil.run(["/usr/bin/systemctl", "--system", "daemon-reload"])
+ except:
+ pass
+ else:
+@@ -236,7 +236,7 @@ class SystemdService(base.PlatformService):
+ if ipautil.dir_exists(srv_tgt):
+ if os.path.islink(srv_lnk):
+ os.unlink(srv_lnk)
+- ipautil.run(["/bin/systemctl", "--system", "daemon-reload"])
++ ipautil.run(["/usr/bin/systemctl", "--system", "daemon-reload"])
+ except:
+ pass
+ else:
+@@ -244,13 +244,13 @@ class SystemdService(base.PlatformService):
+
+ def __enable(self, instance_name=""):
+ try:
+- ipautil.run(["/bin/systemctl", "enable", self.service_instance(instance_name)])
++ ipautil.run(["/usr/bin/systemctl", "enable", self.service_instance(instance_name)])
+ except ipautil.CalledProcessError, e:
+ pass
+
+ def __disable(self, instance_name=""):
+ try:
+- ipautil.run(["/bin/systemctl", "disable", self.service_instance(instance_name)])
++ ipautil.run(["/usr/bin/systemctl", "disable", self.service_instance(instance_name)])
+ except ipautil.CalledProcessError, e:
+ pass
+
+diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
+index 126bbae..a1f729e 100644
+--- a/ipaserver/install/cainstance.py
++++ b/ipaserver/install/cainstance.py
+@@ -57,7 +57,7 @@ from ipaserver.install.installutils import stopped_service
+ from ipaserver.plugins import ldap2
+ from ipapython.ipa_log_manager import *
+
+-HTTPD_CONFD = "/etc/httpd/conf.d/"
++HTTPD_CONFD = "/etc/httpd/conf/extra/"
+ DEFAULT_DSPORT = dogtag.install_constants.DS_PORT
+
+ PKI_USER = "pkiuser"
+diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py
+index 689e657..d4a3252 100644
+--- a/ipaserver/install/httpinstance.py
++++ b/ipaserver/install/httpinstance.py
+@@ -37,8 +37,8 @@ from ipaserver.install import sysupgrade
+ from ipalib import api
+
+ HTTPD_DIR = "/etc/httpd"
+-SSL_CONF = HTTPD_DIR + "/conf.d/ssl.conf"
+-NSS_CONF = HTTPD_DIR + "/conf.d/nss.conf"
++SSL_CONF = HTTPD_DIR + "/conf/extra/ssl.conf"
++NSS_CONF = HTTPD_DIR + "/conf/extra/nss.conf"
+
+ selinux_warning = """
+ WARNING: could not set selinux boolean(s) %(var)s to true. The web
+@@ -223,7 +223,7 @@ class HTTPInstance(service.Service):
+ def configure_httpd_ccache(self):
+ pent = pwd.getpwnam("apache")
+ ccache = '/tmp/krb5cc_%d' % pent.pw_uid
+- filepath = '/etc/sysconfig/httpd'
++ filepath = '/etc/conf.d/apache'
+ if not os.path.exists(filepath):
+ # file doesn't exist; create it with correct ownership & mode
+ open(filepath, 'a').close()
+@@ -237,17 +237,17 @@ class HTTPInstance(service.Service):
+ ipaservices.restore_context(filepath)
+
+ def __configure_http(self):
+- target_fname = '/etc/httpd/conf.d/ipa.conf'
++ target_fname = '/etc/httpd/conf/extra/ipa.conf'
+ http_txt = ipautil.template_file(ipautil.SHARE_DIR + "ipa.conf", self.sub_dict)
+- self.fstore.backup_file("/etc/httpd/conf.d/ipa.conf")
++ self.fstore.backup_file("/etc/httpd/conf/extra/ipa.conf")
+ http_fd = open(target_fname, "w")
+ http_fd.write(http_txt)
+ http_fd.close()
+ os.chmod(target_fname, 0644)
+
+- target_fname = '/etc/httpd/conf.d/ipa-rewrite.conf'
++ target_fname = '/etc/httpd/conf/extra/ipa-rewrite.conf'
+ http_txt = ipautil.template_file(ipautil.SHARE_DIR + "ipa-rewrite.conf", self.sub_dict)
+- self.fstore.backup_file("/etc/httpd/conf.d/ipa-rewrite.conf")
++ self.fstore.backup_file("/etc/httpd/conf/extra/ipa-rewrite.conf")
+ http_fd = open(target_fname, "w")
+ http_fd.write(http_txt)
+ http_fd.close()
+@@ -285,8 +285,8 @@ class HTTPInstance(service.Service):
+
+ def __add_include(self):
+ """This should run after __set_mod_nss_port so is already backed up"""
+- if installutils.update_file(NSS_CONF, '</VirtualHost>', 'Include conf.d/ipa-rewrite.conf\n</VirtualHost>') != 0:
+- print "Adding Include conf.d/ipa-rewrite to %s failed." % NSS_CONF
++ if installutils.update_file(NSS_CONF, '</VirtualHost>', 'Include conf/extra/ipa-rewrite.conf\n</VirtualHost>') != 0:
++ print "Adding Include conf/extra/ipa-rewrite to %s failed." % NSS_CONF
+
+ def __setup_ssl(self):
+ fqdn = self.fqdn
+@@ -425,7 +425,7 @@ class HTTPInstance(service.Service):
+ if not enabled is None and not enabled:
+ self.disable()
+
+- for f in ["/etc/httpd/conf.d/ipa.conf", SSL_CONF, NSS_CONF]:
++ for f in ["/etc/httpd/conf/extra/ipa.conf", SSL_CONF, NSS_CONF]:
+ try:
+ self.fstore.restore_file(f)
+ except ValueError, error:
+@@ -433,9 +433,9 @@ class HTTPInstance(service.Service):
+ pass
+
+ # Remove the configuration files we create
+- installutils.remove_file("/etc/httpd/conf.d/ipa-rewrite.conf")
+- installutils.remove_file("/etc/httpd/conf.d/ipa.conf")
+- installutils.remove_file("/etc/httpd/conf.d/ipa-pki-proxy.conf")
++ installutils.remove_file("/etc/httpd/conf/extra/ipa-rewrite.conf")
++ installutils.remove_file("/etc/httpd/conf/extra/ipa.conf")
++ installutils.remove_file("/etc/httpd/conf/extra/ipa-pki-proxy.conf")
+
+ for var in ["httpd_can_network_connect", "httpd_manage_ipa"]:
+ sebool_state = self.restore_state(var)
+diff --git a/ipaserver/install/ipa_backup.py b/ipaserver/install/ipa_backup.py
+index 12c6215..1fb8334 100644
+--- a/ipaserver/install/ipa_backup.py
++++ b/ipaserver/install/ipa_backup.py
+@@ -126,7 +126,7 @@ class Backup(admintool.AdminTool):
+ '/etc/sysconfig/pki-ca',
+ '/etc/sysconfig/pki-tomcat',
+ '/etc/sysconfig/dirsrv',
+- '/etc/sysconfig/ntpd',
++ '/etc/conf.d/ntpd.conf',
+ '/etc/sysconfig/krb5kdc',
+ '/etc/sysconfig/pki/ca/pki-ca',
+ '/etc/sysconfig/authconfig',
+@@ -140,10 +140,10 @@ class Backup(admintool.AdminTool):
+ '/etc/security/limits.conf',
+ '/etc/httpd/conf/password.conf',
+ '/etc/httpd/conf/ipa.keytab',
+- '/etc/httpd/conf.d/ipa-pki-proxy.conf',
+- '/etc/httpd/conf.d/ipa-rewrite.conf',
+- '/etc/httpd/conf.d/nss.conf',
+- '/etc/httpd/conf.d/ipa.conf',
++ '/etc/httpd/conf/extra/ipa-pki-proxy.conf',
++ '/etc/httpd/conf/extra/ipa-rewrite.conf',
++ '/etc/httpd/conf/extra/nss.conf',
++ '/etc/httpd/conf/extra/ipa.conf',
+ '/etc/ssh/sshd_config',
+ '/etc/ssh/ssh_config',
+ '/etc/krb5.conf',
+diff --git a/ipaserver/install/ntpinstance.py b/ipaserver/install/ntpinstance.py
+index f2e8ffe..00615b9 100644
+--- a/ipaserver/install/ntpinstance.py
++++ b/ipaserver/install/ntpinstance.py
+@@ -35,7 +35,7 @@ class NTPInstance(service.Service):
+ def __write_config(self):
+
+ self.fstore.backup_file("/etc/ntp.conf")
+- self.fstore.backup_file("/etc/sysconfig/ntpd")
++ self.fstore.backup_file("/etc/conf.d/ntpd.conf")
+
+ # We use the OS variable to point it towards either the rhel
+ # or fedora pools. Other distros should be added in the future
+@@ -99,7 +99,7 @@ class NTPInstance(service.Service):
+ #read in memory, find OPTIONS, check/change it, then overwrite file
+ needopts = [ {'val':'-x', 'need':True},
+ {'val':'-g', 'need':True} ]
+- fd = open("/etc/sysconfig/ntpd", "r")
++ fd = open("/etc/conf.d/ntpd.conf", "r")
+ lines = fd.readlines()
+ fd.close()
+ for line in lines:
+@@ -118,7 +118,7 @@ class NTPInstance(service.Service):
+
+ done = False
+ if newopts:
+- fd = open("/etc/sysconfig/ntpd", "w")
++ fd = open("/etc/conf.d/ntpd.conf", "w")
+ for line in lines:
+ if not done:
+ sline = line.strip()
+--
+1.9.2
+
diff --git a/0002-Add-Arch-Linux-Platform.patch b/0002-Add-Arch-Linux-Platform.patch
new file mode 100644
index 00000000000..01c43d44b59
--- /dev/null
+++ b/0002-Add-Arch-Linux-Platform.patch
@@ -0,0 +1,151 @@
+From 5d78b9364c98435b5f3ee54a27c6c9294366c476 Mon Sep 17 00:00:00 2001
+From: Xiao-Long Chen <chenxiaolong@cxl.epac.to>
+Date: Wed, 16 Apr 2014 19:32:33 -0400
+Subject: [PATCH 2/7] Add Arch Linux Platform
+
+---
+ ipapython/platform/archlinux/__init__.py | 40 ++++++++++++++++++++++++++++++++
+ ipapython/platform/archlinux/auth.py | 17 ++++++++++++++
+ ipapython/platform/fedora16/service.py | 8 +++----
+ ipapython/platform/fedora18/__init__.py | 2 +-
+ ipapython/setup.py | 1 +
+ ipapython/setup.py.in | 1 +
+ 6 files changed, 64 insertions(+), 5 deletions(-)
+ create mode 100644 ipapython/platform/archlinux/__init__.py
+ create mode 100644 ipapython/platform/archlinux/auth.py
+
+diff --git a/ipapython/platform/archlinux/__init__.py b/ipapython/platform/archlinux/__init__.py
+new file mode 100644
+index 0000000..2b77bcc
+--- /dev/null
++++ b/ipapython/platform/archlinux/__init__.py
+@@ -0,0 +1,40 @@
++import os
++
++from ipapython.platform import fedora18, base
++from ipapython.platform.archlinux.auth import ArchLinuxAuthConfig
++
++# All what we allow exporting directly from this module
++# Everything else is made available through these symbols when they are
++# directly imported into ipapython.services:
++# authconfig -- class reference for platform-specific implementation of
++# authconfig(8)
++# service -- class reference for platform-specific implementation of a
++# PlatformService class
++# knownservices -- factory instance to access named services IPA cares about,
++# names are ipapython.services.wellknownservices
++# backup_and_replace_hostname -- platform-specific way to set hostname and
++# make it persistent over reboots
++# restore_network_configuration -- platform-specific way of restoring network
++# configuration (e.g. static hostname)
++# restore_context -- platform-sepcific way to restore security context, if
++# applicable
++# check_selinux_status -- platform-specific way to see if SELinux is enabled
++# and restorecon is installed.
++__all__ = ['authconfig', 'service', 'knownservices',
++ 'backup_and_replace_hostname', 'restore_context', 'check_selinux_status',
++ 'restore_network_configuration', 'timedate_services']
++
++# Just copy a referential list of timedate services
++timedate_services = list(base.timedate_services)
++
++def restore_network_configuration(fstore, statestore):
++ filepath = '/etc/hostname'
++ if fstore.has_file(filepath):
++ fstore.restore_file(filepath)
++
++authconfig = ArchLinuxAuthConfig
++service = fedora18.service
++knownservices = fedora18.knownservices
++backup_and_replace_hostname = fedora18.backup_and_replace_hostname
++restore_context = fedora18.restore_context
++check_selinux_status = fedora18.check_selinux_status
+diff --git a/ipapython/platform/archlinux/auth.py b/ipapython/platform/archlinux/auth.py
+new file mode 100644
+index 0000000..67ee063
+--- /dev/null
++++ b/ipapython/platform/archlinux/auth.py
+@@ -0,0 +1,17 @@
++from ipapython.platform import base
++
++class ArchLinuxAuthConfig(base.AuthConfig):
++ """
++ Arch Linux implementation of the AuthConfig class.
++
++ The freeipa package includes a sss-auth-setup.py Python 3 script which will
++ set up both the NSS and PAM configuration. However, this script modifies the
++ PAM configuration files directly, so the changes need to be undone before
++ pacman updates anything in /etc/pam.d/ and if any new configuration files
++ are added.
++
++ It's probably best to have this handled manually.
++ """
++
++ def execute(self):
++ raise NotImplementedError
+diff --git a/ipapython/platform/fedora16/service.py b/ipapython/platform/fedora16/service.py
+index edf2d7f..7523761 100644
+--- a/ipapython/platform/fedora16/service.py
++++ b/ipapython/platform/fedora16/service.py
+@@ -32,8 +32,8 @@ from ipalib import api
+ # mapping will be kept in this dictionary
+ system_units = dict(map(lambda x: (x, "%s.service" % (x)), base.wellknownservices))
+
+-system_units['rpcgssd'] = 'nfs-secure.service'
+-system_units['rpcidmapd'] = 'nfs-idmap.service'
++system_units['rpcgssd'] = 'rpc-gssd.service'
++system_units['rpcidmapd'] = 'rpc-idmapd.service'
+
+ # Rewrite dirsrv and pki-tomcatd services as they support instances via separate
+ # service generator. To make this working, one needs to have both foo@.servic
+@@ -144,8 +144,8 @@ class Fedora16CAService(Fedora16Service):
+ # false positives, so check for existence of our configuration file.
+ # TODO: Use a cleaner solution
+ use_proxy = True
+- if not (os.path.exists('/etc/httpd/conf.d/ipa.conf') and
+- os.path.exists('/etc/httpd/conf.d/ipa-pki-proxy.conf')):
++ if not (os.path.exists('/etc/httpd/conf/extra/ipa.conf') and
++ os.path.exists('/etc/httpd/conf/extra/ipa-pki-proxy.conf')):
+ root_logger.debug(
+ 'The httpd proxy is not installed, wait on local port')
+ use_proxy = False
+diff --git a/ipapython/platform/fedora18/__init__.py b/ipapython/platform/fedora18/__init__.py
+index d12bdca..2ac882c 100644
+--- a/ipapython/platform/fedora18/__init__.py
++++ b/ipapython/platform/fedora18/__init__.py
+@@ -52,7 +52,7 @@ timedate_services = list(base.timedate_services)
+ def backup_and_replace_hostname(fstore, statestore, hostname):
+ old_hostname = socket.gethostname()
+ try:
+- ipautil.run(['/bin/hostname', hostname])
++ ipautil.run(['/usr/bin/hostname', hostname])
+ except ipautil.CalledProcessError, e:
+ print >>sys.stderr, "Failed to set this machine hostname to %s (%s)." % (hostname, str(e))
+
+diff --git a/ipapython/setup.py b/ipapython/setup.py
+index cb24eee..cffbf6e 100644
+--- a/ipapython/setup.py
++++ b/ipapython/setup.py
+@@ -68,6 +68,7 @@ def setup_package():
+ packages = [ "ipapython",
+ "ipapython.platform",
+ "ipapython.platform.base",
++ "ipapython.platform.archlinux",
+ "ipapython.platform.fedora16",
+ "ipapython.platform.fedora18",
+ "ipapython.platform.redhat" ],
+diff --git a/ipapython/setup.py.in b/ipapython/setup.py.in
+index d3bbcaf..c7c6845 100644
+--- a/ipapython/setup.py.in
++++ b/ipapython/setup.py.in
+@@ -68,6 +68,7 @@ def setup_package():
+ packages = [ "ipapython",
+ "ipapython.platform",
+ "ipapython.platform.base",
++ "ipapython.platform.archlinux",
+ "ipapython.platform.fedora16",
+ "ipapython.platform.fedora18",
+ "ipapython.platform.redhat" ],
+--
+1.9.2
+
diff --git a/0003-Use-Python-2.patch b/0003-Use-Python-2.patch
new file mode 100644
index 00000000000..f948ee2973c
--- /dev/null
+++ b/0003-Use-Python-2.patch
@@ -0,0 +1,657 @@
+From df24bf0bad4a41262217e6864c76eae7e09d7bc8 Mon Sep 17 00:00:00 2001
+From: Xiao-Long Chen <chenxiaolong@cxl.epac.to>
+Date: Wed, 16 Apr 2014 19:32:58 -0400
+Subject: [PATCH 3/7] Use Python 2
+
+---
+ checks/check-ra.py | 2 +-
+ contrib/RHEL4/ipa-client-setup | 2 +-
+ contrib/RHEL4/setup.py | 2 +-
+ daemons/ipa-otpd/test.py | 2 +-
+ doc/examples/python-api.py | 2 +-
+ install/certmonger/dogtag-ipa-retrieve-agent-submit | 2 +-
+ install/po/pygettext.py | 2 +-
+ install/restart_scripts/renew_ca_cert | 2 +-
+ install/restart_scripts/renew_ra_cert | 2 +-
+ install/restart_scripts/restart_dirsrv | 2 +-
+ install/restart_scripts/restart_httpd | 2 +-
+ install/restart_scripts/restart_pkicad | 2 +-
+ install/restart_scripts/stop_pkicad | 2 +-
+ install/share/copy-schema-to-ca.py | 2 +-
+ install/tools/ipa-adtrust-install | 2 +-
+ install/tools/ipa-advise | 2 +-
+ install/tools/ipa-backup | 2 +-
+ install/tools/ipa-ca-install | 2 +-
+ install/tools/ipa-compat-manage | 2 +-
+ install/tools/ipa-csreplica-manage | 2 +-
+ install/tools/ipa-dns-install | 2 +-
+ install/tools/ipa-ldap-updater | 2 +-
+ install/tools/ipa-managed-entries | 2 +-
+ install/tools/ipa-nis-manage | 2 +-
+ install/tools/ipa-replica-conncheck | 2 +-
+ install/tools/ipa-replica-install | 2 +-
+ install/tools/ipa-replica-manage | 2 +-
+ install/tools/ipa-replica-prepare | 2 +-
+ install/tools/ipa-restore | 2 +-
+ install/tools/ipa-server-certinstall | 2 +-
+ install/tools/ipa-server-install | 2 +-
+ install/tools/ipa-upgradeconfig | 2 +-
+ install/tools/ipactl | 2 +-
+ ipa | 2 +-
+ ipa-client/ipa-install/ipa-client-automount | 2 +-
+ ipa-client/ipa-install/ipa-client-install | 2 +-
+ ipapython/Makefile | 8 ++++----
+ ipapython/py_default_encoding/Makefile | 8 ++++----
+ ipapython/setup.py.in | 2 +-
+ ipapython/test/test_ipautil.py | 2 +-
+ ipapython/test/test_ipavalidate.py | 2 +-
+ ipaserver/install/ipa_server_certinstall.py | 2 +-
+ ipatests/i18n.py | 2 +-
+ ipatests/ipa-run-tests | 2 +-
+ ipatests/ipa-test-config | 2 +-
+ ipatests/ipa-test-task | 2 +-
+ ipatests/setup.py.in | 2 +-
+ ipatests/test_ipapython/test_dn.py | 2 +-
+ lite-server.py | 2 +-
+ make-lint | 4 ++--
+ make-test | 2 +-
+ make-testcert | 2 +-
+ makeapi | 2 +-
+ setup-client.py | 2 +-
+ setup.py | 2 +-
+ 55 files changed, 62 insertions(+), 62 deletions(-)
+
+diff --git a/checks/check-ra.py b/checks/check-ra.py
+index 13a4126..a1df50b 100755
+--- a/checks/check-ra.py
++++ b/checks/check-ra.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Authors:
+ # Jason Gerard DeRose <jderose@redhat.com>
+ # John Dennis <jdennis@redhat.com>
+diff --git a/contrib/RHEL4/ipa-client-setup b/contrib/RHEL4/ipa-client-setup
+index 4d1fead..d8f78c1 100644
+--- a/contrib/RHEL4/ipa-client-setup
++++ b/contrib/RHEL4/ipa-client-setup
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Simo Sorce <ssorce@redhat.com>
+ # Karl MacMillan <kmacmillan@mentalrootkit.com>
+ #
+diff --git a/contrib/RHEL4/setup.py b/contrib/RHEL4/setup.py
+index f535875..5d34930 100644
+--- a/contrib/RHEL4/setup.py
++++ b/contrib/RHEL4/setup.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Copyright (C) 2007 Red Hat
+ # see file 'COPYING' for use and warranty information
+ #
+diff --git a/daemons/ipa-otpd/test.py b/daemons/ipa-otpd/test.py
+index d748c82..824f8a2 100644
+--- a/daemons/ipa-otpd/test.py
++++ b/daemons/ipa-otpd/test.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ #
+ # FreeIPA 2FA companion daemon
+ #
+diff --git a/doc/examples/python-api.py b/doc/examples/python-api.py
+index 60578e8..9f315fc 100755
+--- a/doc/examples/python-api.py
++++ b/doc/examples/python-api.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Authors:
+ # Jason Gerard DeRose <jderose@redhat.com>
+ #
+diff --git a/install/certmonger/dogtag-ipa-retrieve-agent-submit b/install/certmonger/dogtag-ipa-retrieve-agent-submit
+index 70cbd82..973af26 100644
+--- a/install/certmonger/dogtag-ipa-retrieve-agent-submit
++++ b/install/certmonger/dogtag-ipa-retrieve-agent-submit
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python -E
++#!/usr/bin/python2 -E
+ #
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/install/po/pygettext.py b/install/po/pygettext.py
+index 5293ebf..4e4212e 100755
+--- a/install/po/pygettext.py
++++ b/install/po/pygettext.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python
++#! /usr/bin/python2
+ # -*- coding: iso-8859-1 -*-
+ # Originally written by Barry Warsaw <barry@zope.com>
+ #
+diff --git a/install/restart_scripts/renew_ca_cert b/install/restart_scripts/renew_ca_cert
+index b10e4b8..da2253b 100644
+--- a/install/restart_scripts/renew_ca_cert
++++ b/install/restart_scripts/renew_ca_cert
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python -E
++#!/usr/bin/python2 -E
+ #
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/install/restart_scripts/renew_ra_cert b/install/restart_scripts/renew_ra_cert
+index e541e4b..919f8fc 100644
+--- a/install/restart_scripts/renew_ra_cert
++++ b/install/restart_scripts/renew_ra_cert
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python -E
++#!/usr/bin/python2 -E
+ #
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/install/restart_scripts/restart_dirsrv b/install/restart_scripts/restart_dirsrv
+index a9bb897..9b22d08 100644
+--- a/install/restart_scripts/restart_dirsrv
++++ b/install/restart_scripts/restart_dirsrv
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python -E
++#!/usr/bin/python2 -E
+ #
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/install/restart_scripts/restart_httpd b/install/restart_scripts/restart_httpd
+index 96f80bd..16a41ee 100644
+--- a/install/restart_scripts/restart_httpd
++++ b/install/restart_scripts/restart_httpd
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python -E
++#!/usr/bin/python2 -E
+ #
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/install/restart_scripts/restart_pkicad b/install/restart_scripts/restart_pkicad
+index f840aeb..9a3d480 100644
+--- a/install/restart_scripts/restart_pkicad
++++ b/install/restart_scripts/restart_pkicad
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python -E
++#!/usr/bin/python2 -E
+ #
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/install/restart_scripts/stop_pkicad b/install/restart_scripts/stop_pkicad
+index bbaf889..c275eae 100644
+--- a/install/restart_scripts/stop_pkicad
++++ b/install/restart_scripts/stop_pkicad
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python -E
++#!/usr/bin/python2 -E
+ #
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/install/share/copy-schema-to-ca.py b/install/share/copy-schema-to-ca.py
+index 1888f12..a5646cd 100755
+--- a/install/share/copy-schema-to-ca.py
++++ b/install/share/copy-schema-to-ca.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python
++#! /usr/bin/python2
+
+ """Copy the IPA schema to the CA directory server instance
+
+diff --git a/install/tools/ipa-adtrust-install b/install/tools/ipa-adtrust-install
+index fe86a94..e81d0ec 100755
+--- a/install/tools/ipa-adtrust-install
++++ b/install/tools/ipa-adtrust-install
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python
++#! /usr/bin/python2
+ #
+ # Authors: Sumit Bose <sbose@redhat.com>
+ # Based on ipa-server-install by Karl MacMillan <kmacmillan@mentalrootkit.com>
+diff --git a/install/tools/ipa-advise b/install/tools/ipa-advise
+index 4ec3c48..6d0d9b9 100755
+--- a/install/tools/ipa-advise
++++ b/install/tools/ipa-advise
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Tomas Babej <tbabej@redhat.com>
+ #
+ # Copyright (C) 2013 Red Hat
+diff --git a/install/tools/ipa-backup b/install/tools/ipa-backup
+index 5bcaa1d..bcdcb30 100755
+--- a/install/tools/ipa-backup
++++ b/install/tools/ipa-backup
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Rob Crittenden <rcritten@redhat.com>
+ #
+ # Copyright (C) 2013 Red Hat
+diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install
+index bb3e595..26f6993 100755
+--- a/install/tools/ipa-ca-install
++++ b/install/tools/ipa-ca-install
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Rob Crittenden <rcritten@redhat.com>
+ #
+ # Copyright (C) 2011 Red Hat
+diff --git a/install/tools/ipa-compat-manage b/install/tools/ipa-compat-manage
+index 7061a3e..bdfb718 100755
+--- a/install/tools/ipa-compat-manage
++++ b/install/tools/ipa-compat-manage
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Authors: Rob Crittenden <rcritten@redhat.com>
+ # Authors: Simo Sorce <ssorce@redhat.com>
+ #
+diff --git a/install/tools/ipa-csreplica-manage b/install/tools/ipa-csreplica-manage
+index ce027be..f2490b9 100755
+--- a/install/tools/ipa-csreplica-manage
++++ b/install/tools/ipa-csreplica-manage
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Rob Crittenden <rcritten@redhat.com>
+ #
+ # Based on ipa-replica-manage by Karl MacMillan <kmacmillan@mentalrootkit.com>
+diff --git a/install/tools/ipa-dns-install b/install/tools/ipa-dns-install
+index 37a07f8..d87007d 100755
+--- a/install/tools/ipa-dns-install
++++ b/install/tools/ipa-dns-install
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Martin Nagy <mnagy@redhat.com>
+ # Based on ipa-server-install by Karl MacMillan <kmacmillan@mentalrootkit.com>
+ #
+diff --git a/install/tools/ipa-ldap-updater b/install/tools/ipa-ldap-updater
+index 0fc5a5b..98081d7 100755
+--- a/install/tools/ipa-ldap-updater
++++ b/install/tools/ipa-ldap-updater
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Authors: Rob Crittenden <rcritten@redhat.com>
+ #
+ # Copyright (C) 2008 Red Hat
+diff --git a/install/tools/ipa-managed-entries b/install/tools/ipa-managed-entries
+index 2cf37e2..6baae74 100755
+--- a/install/tools/ipa-managed-entries
++++ b/install/tools/ipa-managed-entries
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Authors: Jr Aquino <jr.aquino@citrix.com>
+ #
+ # Copyright (C) 2011 Red Hat
+diff --git a/install/tools/ipa-nis-manage b/install/tools/ipa-nis-manage
+index 71c0761..3320be7 100755
+--- a/install/tools/ipa-nis-manage
++++ b/install/tools/ipa-nis-manage
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Authors: Rob Crittenden <rcritten@redhat.com>
+ # Authors: Simo Sorce <ssorce@redhat.com>
+ #
+diff --git a/install/tools/ipa-replica-conncheck b/install/tools/ipa-replica-conncheck
+index c861e30..2c92eb9 100755
+--- a/install/tools/ipa-replica-conncheck
++++ b/install/tools/ipa-replica-conncheck
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Martin Kosek <mkosek@redhat.com>
+ #
+ # Copyright (C) 2011 Red Hat
+diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
+index 4418b41..512a4fb 100755
+--- a/install/tools/ipa-replica-install
++++ b/install/tools/ipa-replica-install
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
+ #
+ # Copyright (C) 2007 Red Hat
+diff --git a/install/tools/ipa-replica-manage b/install/tools/ipa-replica-manage
+index 8e0948e..b768ea4 100755
+--- a/install/tools/ipa-replica-manage
++++ b/install/tools/ipa-replica-manage
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
+ #
+ # Copyright (C) 2007 Red Hat
+diff --git a/install/tools/ipa-replica-prepare b/install/tools/ipa-replica-prepare
+index 21df341..4f37b4b 100755
+--- a/install/tools/ipa-replica-prepare
++++ b/install/tools/ipa-replica-prepare
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Petr Viktorin <pviktori@redhat.com>
+ #
+ # Copyright (C) 2012 Red Hat
+diff --git a/install/tools/ipa-restore b/install/tools/ipa-restore
+index 604175b..f2572d5 100755
+--- a/install/tools/ipa-restore
++++ b/install/tools/ipa-restore
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Rob Crittenden <rcritten@redhat.com>
+ #
+ # Copyright (C) 2013 Red Hat
+diff --git a/install/tools/ipa-server-certinstall b/install/tools/ipa-server-certinstall
+index 9bb0ef8..a0013f6 100755
+--- a/install/tools/ipa-server-certinstall
++++ b/install/tools/ipa-server-certinstall
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Jan Cholasta <jcholast@redhat.com>
+ #
+ # Copyright (C) 2013 Red Hat
+diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
+index dfbbb91..753c7f0 100755
+--- a/install/tools/ipa-server-install
++++ b/install/tools/ipa-server-install
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
+ # Simo Sorce <ssorce@redhat.com>
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig
+index c565d27..174ab1b 100644
+--- a/install/tools/ipa-upgradeconfig
++++ b/install/tools/ipa-upgradeconfig
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ #
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/install/tools/ipactl b/install/tools/ipactl
+index df0d6f5..48bbab5 100755
+--- a/install/tools/ipactl
++++ b/install/tools/ipactl
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Authors: Simo Sorce <ssorce@redhat.com>
+ #
+ # Copyright (C) 2008-2010 Red Hat
+diff --git a/ipa b/ipa
+index c9b7338..64ceea4 100755
+--- a/ipa
++++ b/ipa
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+
+ # Authors:
+ # Jason Gerard DeRose <jderose@redhat.com>
+diff --git a/ipa-client/ipa-install/ipa-client-automount b/ipa-client/ipa-install/ipa-client-automount
+index 000de4e..050bbf3 100755
+--- a/ipa-client/ipa-install/ipa-client-automount
++++ b/ipa-client/ipa-install/ipa-client-automount
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python -E
++#!/usr/bin/python2 -E
+ #
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/ipa-client/ipa-install/ipa-client-install b/ipa-client/ipa-install/ipa-client-install
+index 0f42e4b..19bfe9c 100755
+--- a/ipa-client/ipa-install/ipa-client-install
++++ b/ipa-client/ipa-install/ipa-client-install
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ # Authors: Simo Sorce <ssorce@redhat.com>
+ # Karl MacMillan <kmacmillan@mentalrootkit.com>
+ #
+diff --git a/ipapython/Makefile b/ipapython/Makefile
+index a09ffd1..d1a3ff5 100644
+--- a/ipapython/Makefile
++++ b/ipapython/Makefile
+@@ -1,4 +1,4 @@
+-PYTHONLIBDIR ?= $(shell python -c "from distutils.sysconfig import *; print get_python_lib()")
++PYTHONLIBDIR ?= $(shell python2 -c "from distutils.sysconfig import *; print get_python_lib()")
+ PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/ipa
+ CONFIGDIR ?= $(DESTDIR)/etc/ipa
+ TESTS = $(wildcard test/*.py)
+@@ -12,9 +12,9 @@ all:
+
+ install:
+ if [ "$(DESTDIR)" = "" ]; then \
+- python setup.py install; \
++ python2 setup.py install; \
+ else \
+- python setup.py install --root $(DESTDIR); \
++ python2 setup.py install --root $(DESTDIR); \
+ fi
+ @for subdir in $(SUBDIRS); do \
+ (cd $$subdir && $(MAKE) $@) || exit 1; \
+@@ -42,4 +42,4 @@ maintainer-clean: distclean
+ test: $(subst .py,.tst,$(TESTS))
+
+ %.tst: %.py
+- python $<
++ python2 $<
+diff --git a/ipapython/py_default_encoding/Makefile b/ipapython/py_default_encoding/Makefile
+index 7cd1f6c..88f17f7 100644
+--- a/ipapython/py_default_encoding/Makefile
++++ b/ipapython/py_default_encoding/Makefile
+@@ -1,15 +1,15 @@
+-PYTHONLIBDIR ?= $(shell python -c "from distutils.sysconfig import *; print get_python_lib()")
++PYTHONLIBDIR ?= $(shell python2 -c "from distutils.sysconfig import *; print get_python_lib()")
+ PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/ipa
+ CONFIGDIR ?= $(DESTDIR)/etc/ipa
+
+ all:
+- python setup.py build
++ python2 setup.py build
+
+ install:
+ if [ "$(DESTDIR)" = "" ]; then \
+- python setup.py install; \
++ python2 setup.py install; \
+ else \
+- python setup.py install --root $(DESTDIR); \
++ python2 setup.py install --root $(DESTDIR); \
+ fi
+
+ clean:
+diff --git a/ipapython/setup.py.in b/ipapython/setup.py.in
+index c7c6845..2860daf 100644
+--- a/ipapython/setup.py.in
++++ b/ipapython/setup.py.in
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Copyright (C) 2007 Red Hat
+ # see file 'COPYING' for use and warranty information
+ #
+diff --git a/ipapython/test/test_ipautil.py b/ipapython/test/test_ipautil.py
+index ff9f282..abc19b3 100644
+--- a/ipapython/test/test_ipautil.py
++++ b/ipapython/test/test_ipautil.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ #
+ # Copyright (C) 2007 Red Hat
+ # see file 'COPYING' for use and warranty information
+diff --git a/ipapython/test/test_ipavalidate.py b/ipapython/test/test_ipavalidate.py
+index 12b1577..3393de0 100644
+--- a/ipapython/test/test_ipavalidate.py
++++ b/ipapython/test/test_ipavalidate.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python -E
++#! /usr/bin/python2 -E
+ #
+ # Copyright (C) 2007 Red Hat
+ # see file 'COPYING' for use and warranty information
+diff --git a/ipaserver/install/ipa_server_certinstall.py b/ipaserver/install/ipa_server_certinstall.py
+index 87c4eaf..09d8fba 100644
+--- a/ipaserver/install/ipa_server_certinstall.py
++++ b/ipaserver/install/ipa_server_certinstall.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python
++#! /usr/bin/python2
+ # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
+ # Jan Cholasta <jcholast@redhat.com>
+ #
+diff --git a/ipatests/i18n.py b/ipatests/i18n.py
+index 9c8479b..e0ddfda 100755
+--- a/ipatests/i18n.py
++++ b/ipatests/i18n.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Authors:
+ # John Dennis <jdennis@redhat.com>
+ #
+diff --git a/ipatests/ipa-run-tests b/ipatests/ipa-run-tests
+index 2b61d3c..7e3270b 100755
+--- a/ipatests/ipa-run-tests
++++ b/ipatests/ipa-run-tests
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+
+ # Authors:
+ # Petr Viktorin <pviktori@redhat.com>
+diff --git a/ipatests/ipa-test-config b/ipatests/ipa-test-config
+index ea6d2ce..dc94b8a 100755
+--- a/ipatests/ipa-test-config
++++ b/ipatests/ipa-test-config
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python
++#! /usr/bin/python2
+
+ # Authors:
+ # Petr Viktorin <pviktori@redhat.com>
+diff --git a/ipatests/ipa-test-task b/ipatests/ipa-test-task
+index 9daad1c..91bc868 100755
+--- a/ipatests/ipa-test-task
++++ b/ipatests/ipa-test-task
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python
++#! /usr/bin/python2
+
+ # Authors:
+ # Petr Viktorin <pviktori@redhat.com>
+diff --git a/ipatests/setup.py.in b/ipatests/setup.py.in
+index afbe9ab..dabf6d9 100644
+--- a/ipatests/setup.py.in
++++ b/ipatests/setup.py.in
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Copyright (C) 2007 Red Hat
+ # see file 'COPYING' for use and warranty information
+ #
+diff --git a/ipatests/test_ipapython/test_dn.py b/ipatests/test_ipapython/test_dn.py
+index cdeab93..60802b7 100644
+--- a/ipatests/test_ipapython/test_dn.py
++++ b/ipatests/test_ipapython/test_dn.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+
+ import unittest
+ from ipapython.dn import *
+diff --git a/lite-server.py b/lite-server.py
+index e065357..99089b0 100755
+--- a/lite-server.py
++++ b/lite-server.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+
+ # Authors:
+ # Jason Gerard DeRose <jderose@redhat.com>
+diff --git a/make-lint b/make-lint
+index d9c66a8..21d7b53 100755
+--- a/make-lint
++++ b/make-lint
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ #
+ # Authors:
+ # Jakub Hrozek <jhrozek@redhat.com>
+@@ -198,7 +198,7 @@ def find_files(path, basepath):
+ line = file.readline(128)
+ file.close()
+
+- if line[:2] == '#!' and line.find('python') >= 0:
++ if line[:2] == '#!' and line.find('python2') >= 0:
+ result.append(filepath)
+
+ return result
+diff --git a/make-test b/make-test
+index b39e4db..1cf5bb3 100755
+--- a/make-test
++++ b/make-test
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+
+ """
+ Run IPA unit tests under multiple versions of Python (if present).
+diff --git a/make-testcert b/make-testcert
+index 19c188a..ff25b39 100755
+--- a/make-testcert
++++ b/make-testcert
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ #
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+diff --git a/makeapi b/makeapi
+index 86907bd..df8497c 100755
+--- a/makeapi
++++ b/makeapi
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+ # Authors:
+ # Rob Crittenden <rcritten@redhat.com>
+ # John Dennis <jdennis@redhat.com>
+diff --git a/setup-client.py b/setup-client.py
+index 332d292..a424440 100755
+--- a/setup-client.py
++++ b/setup-client.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+
+ # Authors:
+ # Jason Gerard DeRose <jderose@redhat.com>
+diff --git a/setup.py b/setup.py
+index 4a01b1e..af7964d 100755
+--- a/setup.py
++++ b/setup.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python2
+
+ # Authors:
+ # Jason Gerard DeRose <jderose@redhat.com>
+--
+1.9.2
+
diff --git a/0004-NTP-Fixes.patch b/0004-NTP-Fixes.patch
new file mode 100644
index 00000000000..3cbf2a21f3c
--- /dev/null
+++ b/0004-NTP-Fixes.patch
@@ -0,0 +1,38 @@
+From 2b3e1e8cf40dd1ea203da3f50625277c5f9c253b Mon Sep 17 00:00:00 2001
+From: Xiao-Long Chen <chenxiaolong@cxl.epac.to>
+Date: Wed, 16 Apr 2014 19:33:44 -0400
+Subject: [PATCH 4/7] NTP Fixes
+
+---
+ ipa-client/ipaclient/ntpconf.py | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/ipa-client/ipaclient/ntpconf.py b/ipa-client/ipaclient/ntpconf.py
+index 7c95a46..4a39200 100644
+--- a/ipa-client/ipaclient/ntpconf.py
++++ b/ipa-client/ipaclient/ntpconf.py
+@@ -109,9 +109,9 @@ def config_ntp(server_fqdn, fstore = None, sysstore = None):
+ if os.path.exists(path_step_tickers):
+ config_step_tickers = True
+ ns = ipautil.template_str(ntp_step_tickers, sub_dict)
+- __backup_config(path_step_tickers, fstore)
+- __write_config(path_step_tickers, ns)
+- ipaservices.restore_context(path_step_tickers)
++ #__backup_config(path_step_tickers, fstore)
++ #__write_config(path_step_tickers, ns)
++ #ipaservices.restore_context(path_step_tickers)
+
+ if sysstore:
+ module = 'ntp'
+@@ -146,7 +146,7 @@ def synconce_ntp(server_fqdn):
+ if os.path.exists(ntpdate):
+ # retry several times -- logic follows /etc/init.d/ntpdate
+ # implementation
+- cmd = [ntpdate, "-U", "ntp", "-s", "-b", "-v", server_fqdn]
++ cmd = [ntpdate, "-s", "-b", "-v", server_fqdn]
+ for retry in range(0, 3):
+ try:
+ ipautil.run(cmd)
+--
+1.9.2
+
diff --git a/0005-Fix-nss-includes.patch b/0005-Fix-nss-includes.patch
new file mode 100644
index 00000000000..9291e511bae
--- /dev/null
+++ b/0005-Fix-nss-includes.patch
@@ -0,0 +1,40 @@
+From e4a871010d86affbf1a3e9d29bf3ec366056f55a Mon Sep 17 00:00:00 2001
+From: Xiao-Long Chen <chenxiaolong@cxl.epac.to>
+Date: Wed, 16 Apr 2014 19:34:03 -0400
+Subject: [PATCH 5/7] Fix nss includes
+
+---
+ util/ipa_pwd.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/util/ipa_pwd.c b/util/ipa_pwd.c
+index 761d1ef..4363706 100644
+--- a/util/ipa_pwd.c
++++ b/util/ipa_pwd.c
+@@ -27,10 +27,10 @@
+ #include <stdio.h>
+ #include <time.h>
+ #include <ctype.h>
+-#include <nss3/nss.h>
+-#include <nss3/nssb64.h>
+-#include <nss3/hasht.h>
+-#include <nss3/pk11pub.h>
++#include <nss/nss.h>
++#include <nss/nssb64.h>
++#include <nss/hasht.h>
++#include <nss/pk11pub.h>
+ #include <errno.h>
+ #include "ipa_pwd.h"
+
+@@ -159,7 +159,7 @@ static int ipapwd_gentime_cmp(const void *p1, const void *p2)
+
+ #define SHA_SALT_LENGTH 8
+
+-/* SHA*_LENGTH leghts come from nss3/hasht.h */
++/* SHA*_LENGTH leghts come from nss/hasht.h */
+ #define SHA_HASH_MAX_LENGTH SHA512_LENGTH
+
+ static int ipapwd_hash_type_to_alg(char *hash_type,
+--
+1.9.2
+
diff --git a/0006-Disable-make-testcert.patch b/0006-Disable-make-testcert.patch
new file mode 100644
index 00000000000..120e30f8f2f
--- /dev/null
+++ b/0006-Disable-make-testcert.patch
@@ -0,0 +1,24 @@
+From e4288e533f9dc3111d4b552b51b9e236459c7415 Mon Sep 17 00:00:00 2001
+From: Xiao-Long Chen <chenxiaolong@cxl.epac.to>
+Date: Wed, 16 Apr 2014 19:34:24 -0400
+Subject: [PATCH 6/7] Disable make testcert
+
+---
+ Makefile | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index eeeb605..c80ff33 100644
+--- a/Makefile
++++ b/Makefile
+@@ -110,7 +110,6 @@ lint: bootstrap-autogen
+
+
+ test:
+- ./make-testcert
+ ./make-test
+
+ release-update:
+--
+1.9.2
+
diff --git a/0007-Fix-nosetests-path.patch b/0007-Fix-nosetests-path.patch
new file mode 100644
index 00000000000..fe90c757f91
--- /dev/null
+++ b/0007-Fix-nosetests-path.patch
@@ -0,0 +1,25 @@
+From 9a3ed6203f651568f2f02debbaa223cb3e95fcfc Mon Sep 17 00:00:00 2001
+From: Xiao-Long Chen <chenxiaolong@cxl.epac.to>
+Date: Wed, 16 Apr 2014 19:34:55 -0400
+Subject: [PATCH 7/7] Fix nosetests path
+
+---
+ make-test | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/make-test b/make-test
+index 1cf5bb3..23a5790 100755
+--- a/make-test
++++ b/make-test
+@@ -12,7 +12,7 @@ from subprocess import call
+
+ versions = ('2.4', '2.5', '2.6', '2.7')
+ python = '/usr/bin/python'
+-nose = '/usr/bin/nosetests'
++nose = '/usr/bin/nosetests2'
+ ran = []
+ fail = []
+
+--
+1.9.2
+
diff --git a/PKGBUILD b/PKGBUILD
new file mode 100644
index 00000000000..934eb4705be
--- /dev/null
+++ b/PKGBUILD
@@ -0,0 +1,348 @@
+# Maintainer: Jan Cholasta <grubber at grubber cz>
+# Contributor: Xiao-Long Chen <chenxiaolong@cxl.epac.to>
+
+# Based on commit b9a15de92091334a6ff3fc9074655f6e5d9f24dd from the fedpkg
+# master branch for freeipa.
+
+# NOTE: ntp, autofs, and ntp support is currently broken because the formats of
+# the /etc/conf.d/ configuration files in Arch Linux differ from the formats of
+# Fedora's /etc/sysconfig/ configuration files.
+
+# Active directory trusts will not (probably never) work in Arch. It requires a
+# heavily patched version of Samba 4, which uses MIT Kerberos instead of
+# Heimdal. (Fedora went through 174 releases to get this working O_O)
+
+# Client only, for now
+build_server=false
+
+# AUR workaround
+pkgname=freeipa
+
+pkgbase=freeipa
+: && pkgname=('freeipa')
+
+if [ "x${build_server}" == "xtrue" ]; then
+ pkgname+=('freeipa-server')
+fi
+
+pkgver=3.3.5
+pkgrel=1
+pkgdesc="The Identity, Policy, and Audit system"
+arch=('i686' 'x86_64')
+url="http://www.freeipa.org/"
+license=('GPL')
+
+# Client dependencies
+makedepends=()
+
+# FreeIPA server dependencies
+if [ "x${build_server}" == "xtrue" ]; then
+ makedepends+=('389-ds-base'
+ #'libwbclient'
+ 'samba'
+ 'svrcore'
+ 'talloc'
+ 'tevent')
+
+ # SELinux dependencies
+ #makedepends+=('selinux-refpolicy-arch'
+ # 'selinux-usr-checkpolicy'
+ # 'selinux-usr-policycoreutils')
+fi
+
+# Other dependencies
+makedepends+=('curl'
+ 'java-runtime>=7'
+ 'krb5'
+ 'libunistring'
+ 'nspr'
+ 'nss'
+ 'openssl'
+ 'openldap'
+ 'popt'
+ 'python2'
+ 'python2-distribute'
+ 'python2-dnspython'
+ 'python2-kerberos'
+ 'python2-krbv'
+ 'python2-ldap'
+ 'python2-lxml'
+ 'python2-memcached'
+ 'python2-m2crypto'
+ 'python2-netaddr'
+ 'python2-nss'
+ 'python2-polib'
+ 'python2-pyasn1'
+ 'python2-pylint'
+ 'python2-pyopenssl'
+ # Red Hat specific
+ #'python2-rhsm'
+ 'sssd'
+ 'xmlrpc-c')
+
+# Dependencies for "make check"
+checkdepends=('check' 'python2-nose')
+
+options=('!libtool')
+source=("http://www.freeipa.org/downloads/src/freeipa-${pkgver}.tar.gz"
+ 'sss-auth-setup.py'
+ '0001-Use-Arch-Linux-Paths.patch'
+ '0002-Add-Arch-Linux-Platform.patch'
+ '0003-Use-Python-2.patch'
+ '0004-NTP-Fixes.patch'
+ '0005-Fix-nss-includes.patch'
+ '0006-Disable-make-testcert.patch'
+ '0007-Fix-nosetests-path.patch')
+sha512sums=('58325e7a619eeb0170dd32a648f22e50c0df2d7bc0a7609b6f0be3b8328890e5e027ba094fd4970ac063544b4d163f4e07ac62c1b358dba5246e148c2fd830b6'
+ '5f101692e311205b3706642c6f329459646aaa693683ab2d4847bd8a7f464ef99ec617b0422df8e25ec2a0dc3a68cd9bf54db4bb3013b84844df15160716adc8'
+ '604927b05f248c6ee8a42c87198a3ab05aa2a98b3a8f4b9ee0352e049d9e59195eac2292b609a9f84b176875cd6640d118f7e5c35f74b042f7e03561aafd2c04'
+ '7bd0dba218626f27f918b9cf15cf25183a90421ee2c792648f36e6cd75cf09f2ff04e30a9419f6033aa4d640fc1f7dcfa973fec9fc2c74354bb1e609621d449b'
+ '872a172451c436fc916b72bc48733905b4f9298ece39ad737f60790e9fe2da896dfd2255f58d7aeb301c9c19a2bb2078684ca8449f9dec5dcb45fc1f5bda7b30'
+ 'a70bcc98ea71e8154e7600d6bf7ed8de6bbb73d31b5ccb0b556a538e9cce78fbd71698e3be6cfa33487226e0e79d6fb8ee78d926259a4543fe4300a6b90b9a09'
+ '294a6e3a09cada150dd0f21c712f312840a882acb067520b70ebd058cd4ee88863a2a828df63efc190c5608ffb0d71d60253883baddeb7487aec7b3d905abb04'
+ '5bc0afc21a9a178ace728f902422683502b6cf579585bc8feab42d1f7701e8609468e92265b22c7f1f958f0f175f3287ea011e8f149fb30b231708e15b6eefd2'
+ '0a79540e0df4e7b0fed8fd378411799fc5b2152795e1938df2ee6935e944517cd8c780740e8aec2f718476f3b5bd0a36113b85add04d4bdb180da5ba80c37c50')
+
+build() {
+ cd "${srcdir}/${pkgbase}-${pkgver}"
+
+ # Change Fedora's paths to the equivalents in Arch Linux
+ patch -p1 -i "${srcdir}/0001-Use-Arch-Linux-Paths.patch"
+ # Make slight changes to Fedora 18's platform code (systemd service names,
+ # /bin/ -> /usr/bin/, etc) and add a minimal Arch Linux platform that
+ # calls most of Fedora 18's platform, except for AuthConfig
+ patch -p1 -i "${srcdir}/0002-Add-Arch-Linux-Platform.patch"
+ # FreeIPA hasn't been ported to Python 3, so the code must be modified to
+ # run /usr/bin/python2
+ patch -p1 -i "${srcdir}/0003-Use-Python-2.patch"
+ # Arch Linux's ntp does not accept the '-U' parameter and does not have a
+ # /etc/sysconfig/ configuration files, so the relevant code must be removed
+ patch -p1 -i "${srcdir}/0004-NTP-Fixes.patch"
+ # Arch Linux's nss package installs the header files to /usr/include/nss/
+ # instead of /usr/include/nss3/
+ patch -p1 -i "${srcdir}/0005-Fix-nss-includes.patch"
+ # make-testcert requires a running certificate server to work properly
+ patch -p1 -i "${srcdir}/0006-Disable-make-testcert.patch"
+ # Arch Linux's python2-nose package installs nosetests as
+ # /usr/bin/nosetests2
+ patch -p1 -i "${srcdir}/0007-Fix-nosetests-path.patch"
+
+ export SUPPORTED_PLATFORM=archlinux
+ export PYTHON=python2
+
+ # Force regeneration of platform support
+ rm ipapython/services.py
+
+ make version-update
+
+ pushd ipa-client
+ ../autogen.sh --prefix=/usr --sysconfdir=/etc --sbindir=/usr/bin
+ popd
+
+ if [ "x${build_server}" == "xtrue" ]; then
+ pushd daemons
+ ../autogen.sh --prefix=/usr --sysconfdir=/etc --sbindir=/usr/bin --with-openldap
+ popd
+
+ pushd install
+ ../autogen.sh --prefix=/usr --sysconfdir=/etc --sbindir=/usr/bin
+ popd
+
+ make IPA_VERSION_IS_GIT_SNAPSHOT=no all
+ else
+ make IPA_VERSION_IS_GIT_SNAPSHOT=no client
+ fi
+}
+
+check() {
+ cd "${srcdir}/${pkgbase}-${pkgver}"
+ # Tests require FreeIPA to be installed and set up
+ #make test
+}
+
+# All files are in freeipa package. This one is here only for the dependencies.
+package_freeipa-server() {
+ : && pkgdesc="The IPA authentication server"
+ depends=("freeipa=${pkgver}-${pkgrel}"
+ '389-ds-base'
+ 'acl'
+ 'apache'
+ 'cyrus-sasl-gssapi'
+ 'keyutils'
+ 'krb5'
+ 'memcached'
+ 'mod_auth_kerb'
+ 'mod_nss'
+ 'mod_wsgi'
+ 'nss'
+ 'ntp'
+ 'openldap'
+ 'python2-dnspython'
+ 'python2-krbv'
+ 'python2-ldap'
+ 'python2-memcached'
+ 'python2-pyasn1'
+ 'slapi-nis'
+ 'systemd'
+ 'tomcat7'
+ 'zip')
+ optdepends=('python2-m2crypto: For Microsoft Active Directory trusts'
+ 'samba: For Microsoft Active Directory trusts'
+ 'sssd: For Microsoft Active Directory trusts')
+ backup=('etc/ipa/html/browserconfig.html'
+ 'etc/ipa/html/ffconfig.js'
+ 'etc/ipa/html/ffconfig_page.js'
+ 'etc/ipa/html/ipa_error.css'
+ 'etc/ipa/html/ssbrowser.html'
+ 'etc/ipa/html/unauthorized.html')
+ # Backup files created by this package
+ backup+=('etc/httpd/conf/extra/ipa-rewrite.conf'
+ 'etc/httpd/conf/extra/ipa.conf'
+ 'etc/httpd/conf/extra/ipa-pki-proxy.conf'
+ 'usr/share/ipa/html/ca.crt')
+ install=install.freeipa-server
+
+ # SELinux dependencies
+ #depends+=("freeipa-server-selinux=${pkgver}-${pkgrel}"
+ # 'selinux-refpolicy-arch'
+ # 'selinux-usr-policycoreutils')
+
+ # Conflicts with mod_ssl, but that is a part of the apache package
+ #conflicts=('mod_ssl')
+}
+
+package_freeipa() {
+ : && pkgdesc="IPA authentication for use on clients"
+ depends=('autofs'
+ 'bind'
+ 'certmonger'
+ 'curl'
+ 'cyrus-sasl-gssapi'
+ 'gnupg'
+ 'iproute2'
+ 'nfs-utils'
+ 'nfsidmap'
+ 'nss'
+ 'ntp'
+ 'oddjob'
+ 'pam-krb5'
+ 'python2-dnspython'
+ 'python2-kerberos'
+ 'python2-krbv'
+ 'python2-ldap'
+ 'python2-lxml'
+ 'python2-netaddr'
+ 'python2-nss'
+ 'python2-pyopenssl'
+ 'sssd'
+ 'wget'
+ 'xmlrpc-c')
+ backup=('etc/ipa/default.conf'
+ 'etc/ipa/ca.crt')
+ install=install.freeipa
+
+ # authconfig is Fedora specific
+ #depends+=('authconfig')
+
+ install -dm755 "${pkgdir}/usr/bin/"
+ install -m755 "${srcdir}/sss-auth-setup.py" \
+ "${pkgdir}/usr/bin/sss-auth-setup"
+
+ cd "${srcdir}/${pkgbase}-${pkgver}"
+
+ export SUPPORTED_PLATFORM=archlinux
+ export PYTHON=python2
+
+ # Force regeneration of platform support
+ rm ipapython/services.py
+
+ if [ "x${build_server}" == "xtrue" ]; then
+ make install DESTDIR="${pkgdir}"
+ else
+ make client-install DESTDIR="${pkgdir}"
+ fi
+
+ if [ "x${build_server}" == "xtrue" ]; then
+ # Some user-modifiable HTML files are provided. Move these to /etc and link
+ # back.
+ install -dm755 "${pkgdir}/etc/ipa/html/"
+ install -dm755 "${pkgdir}/var/cache/ipa/sysrestore/"
+ install -dm755 "${pkgdir}/var/cache/ipa/sysupgrade/"
+ install -dm755 "${pkgdir}/usr/share/ipa/html/"
+ ln -s ../../../../etc/ipa/html/ffconfig.js \
+ "${pkgdir}/usr/share/ipa/html/ffconfig.js"
+ ln -s ../../../../etc/ipa/html/ffconfig_page.js \
+ "${pkgdir}/usr/share/ipa/html/ffconfig_page.js"
+ ln -s ../../../../etc/ipa/html/ssbrowser.html \
+ "${pkgdir}/usr/share/ipa/html/ssbrowser.html"
+ ln -s ../../../../etc/ipa/html/unauthorized.html \
+ "${pkgdir}/usr/share/ipa/html/unauthorized.html"
+ ln -s ../../../../etc/ipa/html/browserconfig.html \
+ "${pkgdir}/usr/share/ipa/html/browserconfig.html"
+ ln -s ../../../../etc/ipa/html/ipa_error.css \
+ "${pkgdir}/usr/share/ipa/html/ipa_error.css"
+
+ # So we can own our Apache configuration
+ install -dm755 "${pkgdir}/etc/httpd/conf/extra/"
+ touch "${pkgdir}/etc/httpd/conf/extra/ipa.conf"
+ touch "${pkgdir}/etc/httpd/conf/extra/ipa-pki-proxy.conf"
+ touch "${pkgdir}/etc/httpd/conf/extra/ipa-rewrite.conf"
+ install -dm755 "${pkgdir}/usr/share/ipa/html/"
+ touch "${pkgdir}/usr/share/ipa/html/ca.crt"
+ touch "${pkgdir}/usr/share/ipa/html/configure.jar"
+ touch "${pkgdir}/usr/share/ipa/html/kerberosauth.xpi"
+ touch "${pkgdir}/usr/share/ipa/html/krb.con"
+ touch "${pkgdir}/usr/share/ipa/html/krb.js"
+ touch "${pkgdir}/usr/share/ipa/html/krb5.ini"
+ touch "${pkgdir}/usr/share/ipa/html/krbrealm.con"
+ touch "${pkgdir}/usr/share/ipa/html/preferences.html"
+
+ # systemd service
+ install -dm755 "${pkgdir}/usr/lib/systemd/system/"
+ install -m644 \
+ init/systemd/ipa.service \
+ init/systemd/ipa_memcached.service \
+ "${pkgdir}/usr/lib/systemd/system/"
+
+ # Configuration files
+ install -dm755 "${pkgdir}/etc/conf.d/"
+ install -m644 init/ipa_memcached.conf \
+ "${pkgdir}/etc/conf.d/"
+
+ # /run
+ install -dm755 "${pkgdir}/run/"
+ install -dm700 "${pkgdir}/run/ipa/"
+ install -dm700 "${pkgdir}/run/ipa_memcached/"
+
+ # systemd tmpfiles.d configuration
+ install -dm755 "${pkgdir}/usr/lib/tmpfiles.d/"
+ install -m644 init/systemd/ipa.conf.tmpfiles \
+ "${pkgdir}/usr/lib/tmpfiles.d/ipa.conf"
+
+ # bash completion configuration files
+ install -dm755 "${pkgdir}/etc/bash_completion.d/"
+ install -m644 contrib/completion/ipa.bash_completion \
+ "${pkgdir}/etc/bash_completion.d/ipa"
+
+ # Web UI plugin dir
+ install -dm755 "${pkgdir}/usr/share/ipa/ui/js/plugins/"
+
+ # Backup directory
+ install -dm755 "${pkgdir}/var/lib/ipa/backup/"
+ fi
+
+ install -dm755 "${pkgdir}/var/lib/ipa-client/sysrestore/"
+
+ # /etc/ipa/ is needed for ipa-client-install
+ install -dm755 "${pkgdir}/etc/ipa/"
+
+ # Fix filenames
+ pushd "${pkgdir}/usr/lib/python2.7/site-packages/"
+ mv ipapython-${pkgver}*-py2.7.egg-info ipapython-${pkgver}-py2.7.egg-info
+ popd
+
+ find "${pkgdir}/" \( -name '*.pyc' -o -name '*.pyo' \) -delete
+
+ # Not packaging the tests for now
+ find "${pkgdir}/" -type f | grep '\.py' | grep ipatests | xargs rm -f
+}
diff --git a/install.freeipa b/install.freeipa
new file mode 100644
index 00000000000..4d2bd0e9788
--- /dev/null
+++ b/install.freeipa
@@ -0,0 +1,47 @@
+post_upgrade() {
+ # Has the client been configured?
+ restore=0
+ test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
+
+ if [ -f '/etc/sssd/sssd.conf' -a $restore -ge 2 ]; then
+ if ! grep -Eq '/var/lib/sss/pubconf/krb5.include.d/' /etc/krb5.conf 2>/dev/null; then
+ echo "includedir /var/lib/sss/pubconf/krb5.include.d/" > /etc/krb5.conf.ipanew
+ cat /etc/krb5.conf >> /etc/krb5.conf.ipanew
+ mv /etc/krb5.conf.ipanew /etc/krb5.conf
+ fi
+ fi
+
+ # Has the client been configured?
+ restore=0
+ test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' \
+ && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' \
+ | awk '{print $1}')
+
+ if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
+ if grep -Eq '^(AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys|PubKeyAgent /usr/bin/sss_ssh_authorizedkeys %u)$' /etc/ssh/sshd_config 2>/dev/null; then
+ sed -r '
+ /^(AuthorizedKeysCommand(User|RunAs)|PubKeyAgentRunAs)[ \t]/ d
+ ' /etc/ssh/sshd_config >/etc/ssh/sshd_config.ipanew
+
+ if /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandUser=nobody'; then
+ sed -ri '
+ s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
+ s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandUser nobody/
+ ' /etc/ssh/sshd_config.ipanew
+ elif /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandRunAs=nobody'; then
+ sed -ri '
+ s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
+ s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandRunAs nobody/
+ ' /etc/ssh/sshd_config.ipanew
+ elif /usr/sbin/sshd -t -f /dev/null -o 'PubKeyAgent=/usr/bin/sss_ssh_authorizedkeys %u' -o 'PubKeyAgentRunAs=nobody'; then
+ sed -ri '
+ s/^AuthorizedKeysCommand (.+)$/PubKeyAgent \1 %u/
+ s/^PubKeyAgent .*$/\0\nPubKeyAgentRunAs nobody/
+ ' /etc/ssh/sshd_config.ipanew
+ fi
+
+ mv /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config
+ chmod 600 /etc/ssh/sshd_config
+ fi
+ fi
+}
diff --git a/install.freeipa-server b/install.freeipa-server
new file mode 100644
index 00000000000..08aa85b15e7
--- /dev/null
+++ b/install.freeipa-server
@@ -0,0 +1,34 @@
+post_install() {
+ # Fedora updates systemd and attempts to restart the service, but Arch usually
+ # does not do this.
+ #systemctl --system daemon-reload
+
+ echo "Please install the optional dependencies to set up trusts for Microsoft's"
+ echo "Active Directory. The winbind_krb5_locator.so plugin in the samba package"
+ echo "will also have to be removed."
+ echo
+ echo "IMPORTANT: You MUST include the following files in /etc/httpd/httpd.conf after"
+ echo "running ipa-server-install if you want web access to the administration GUI:"
+ echo " /etc/httpd/conf/extra/ipa-rewrite.conf"
+ echo " /etc/httpd/conf/extra/ipa.conf"
+ echo " /etc/httpd/conf/extra/ipa-pki-proxy.conf"
+}
+
+post_upgrade() {
+ # Update FreeIPA's configuration. It is safe to run even when the
+ # configuration files do not need to be updated.
+ ipa-upgradeconfig
+ ipa-ldap-updater --upgrade
+}
+
+post_remove() {
+ # Remove %ghost'ed (from Fedora's spec) files
+ rm -vf \
+ /usr/share/ipa/html/configure.jar \
+ /usr/share/ipa/html/kerberosauth.xpi \
+ /usr/share/ipa/html/krb.con \
+ /usr/share/ipa/html/krb.js \
+ /usr/share/ipa/html/krb5.ini \
+ /usr/share/ipa/html/krbrealm.con \
+ /usr/share/ipa/html/preferences.html
+}
diff --git a/sss-auth-setup.py b/sss-auth-setup.py
new file mode 100755
index 00000000000..efc6eadcd62
--- /dev/null
+++ b/sss-auth-setup.py
@@ -0,0 +1,338 @@
+#!/usr/bin/env python3
+
+# Written by: Xiao-Long Chen <chenxiaolong@cxl.epac.to>
+# License: GPLv3
+
+import base64
+import hashlib
+import os
+import re
+import shutil
+
+nss_databases = ['passwd', 'group', 'services', 'netgroup', 'automount']
+
+PAM_CONFIG_DIR = '/etc/pam.d/'
+
+def nss_enable_sss():
+ if os.path.exists("/etc/nsswitch.conf.sss_tmp"):
+ os.remove("/etc/nsswitch.conf.sss_tmp")
+
+ # Backup /etc/nsswitch.conf
+ shutil.copyfile("/etc/nsswitch.conf", "/etc/nsswitch.conf.sss_bak")
+
+ nsswitch_orig = open("/etc/nsswitch.conf", 'r')
+ nsswitch_new = open("/etc/nsswitch.conf.sss_tmp", 'w')
+
+ while True:
+ current_line = nsswitch_orig.readline()
+ if not current_line:
+ break
+
+ if current_line != '\n' and current_line.split()[0][:-1] in nss_databases:
+ if "sss" in current_line:
+ print("sss is already enabled for the NSS " +
+ current_line.split()[0][:-1] + " database")
+ else:
+ print("Enabling sss support for the NSS " +
+ current_line.split()[0][:-1] + " database...")
+ if current_line[-1] == '\n':
+ current_line = current_line[:-1] + " sss\n"
+ else:
+ current_line += " sss"
+
+ # Write new file
+ nsswitch_new.write(current_line)
+
+ nsswitch_orig.close()
+ nsswitch_new.close()
+
+ # Replace original /etc/nsswitch.conf
+ shutil.move("/etc/nsswitch.conf.sss_tmp", "/etc/nsswitch.conf")
+
+def nss_disable_sss():
+ if os.path.exists("/etc/nsswitch.conf.sss_tmp"):
+ os.remove("/etc/nsswitch.conf.sss_tmp")
+
+ nsswitch_orig = open("/etc/nsswitch.conf", 'r')
+ nsswitch_new = open("/etc/nsswitch.conf.sss_tmp", 'w')
+
+ while True:
+ current_line = nsswitch_orig.readline()
+ if not current_line:
+ break
+
+ if current_line != '\n' and current_line.split()[0][:-1] in nss_databases:
+ if "sss" in current_line:
+ print("Disabling sss for the NSS " +
+ current_line.split()[0][:-1] + " database...")
+ current_line = re.sub(r"[ \t]+sss[ \t]*", ' ', current_line)
+ # Remove extra spaces
+ current_line = re.sub(r"[ \t]+\n", '\n', current_line)
+
+ # Write new file
+ nsswitch_new.write(current_line)
+
+ nsswitch_orig.close()
+ nsswitch_new.close()
+
+ # Replace original /etc/nsswitch.conf
+ shutil.move("/etc/nsswitch.conf.sss_tmp", "/etc/nsswitch.conf")
+
+def pam_check_header(pam_config):
+ pam_file = open(PAM_CONFIG_DIR + pam_config, 'r')
+
+ inside_header = False
+ has_header = False
+ sha512sum = ''
+ base64enc = ''
+ returned = None
+
+ while True:
+ current_line = pam_file.readline()
+ if not current_line:
+ break
+
+ if current_line == '\n' or current_line == '# \n':
+ continue
+
+ if current_line == '# -----BEGIN PAM BACKUP-----\n':
+ inside_header = True
+
+ elif current_line == '# -----END PAM BACKUP-----\n':
+ if not inside_header:
+ # Invalid because the begin line is missing
+ returned = ('INVALID', None, None)
+ break
+
+ has_header = True
+ break
+
+ elif inside_header:
+ if current_line.startswith('# Hash: '):
+ sha512sum = current_line[8:-1]
+ elif current_line.startswith('# Data: '):
+ base64enc = current_line[8:-1]
+ else:
+ # Invalid because unknown data is in the header
+ returned = ('INVALID', None, None)
+ break
+
+ pam_file.close()
+
+ if has_header:
+ if sha512sum == hashlib.sha512(base64.b64decode(base64enc)).hexdigest():
+ returned = ('VALID', sha512sum, base64enc)
+ else:
+ # Invalid because the checksum of the data does not match the hash
+ returned = ('INVALID', None, None)
+
+ if not returned:
+ returned = ('NONE', None, None)
+
+ return returned
+
+def pam_config_setup(pam_config):
+ pam_file_orig = open(PAM_CONFIG_DIR + pam_config, 'r')
+ pam_file_new = open(PAM_CONFIG_DIR + pam_config + '.sss_tmp', 'a')
+
+ while True:
+ current_line = pam_file_orig.readline()
+ if not current_line:
+ break
+
+ if current_line.startswith('#%PAM-1.0'):
+ continue
+
+ if current_line != '\n' and current_line[0] != '#':
+ current_line_split = current_line.split()
+
+ # Change 'required' to 'sufficient' for the pam_unix.so module
+ if current_line_split[2] == "pam_unix.so" and current_line_split[1] == "required":
+ #pam_file_new.write(current_line.replace("required", "sufficient"))
+ pam_file_new.write(current_line_split[0] + "\t\tinclude\t\tsss\n")
+ continue
+
+ pam_file_new.write(current_line)
+
+ pam_file_orig.close()
+ pam_file_new.close()
+
+def pam_enable_sss():
+ print('Enabling sssd support in:')
+
+ rows, columns = os.popen('stty size', 'r').read().split()
+ columns = int(columns) - 3
+
+ for fullpath, directories, files in os.walk(PAM_CONFIG_DIR):
+ files.sort()
+ for pam_config in files:
+ if pam_config == 'sss' or pam_config == 'sss.bak' or \
+ pam_config.startswith('.') or pam_config.endswith('~'):
+ continue
+
+ status = pam_check_header(pam_config)[0]
+ if status == 'NONE':
+ status_msg = 'done'
+ elif status == 'VALID':
+ status_msg = 'already enabled (skipping)'
+ elif status == 'INVALID':
+ status_msg = 'invalid backup header (skipping)'
+
+ pam_config_path = PAM_CONFIG_DIR + pam_config
+
+ if status == 'NONE':
+ pam_file = open(pam_config_path, 'rb')
+
+ raw_content = pam_file.read()
+ sha512sum = hashlib.sha512(raw_content).hexdigest()
+ base64enc_raw = base64.b64encode(raw_content)
+ base64enc = base64enc_raw.decode('ascii')
+
+ pam_file.close()
+
+ tmp_file = open(pam_config_path + '.sss_tmp', 'w')
+
+ tmp_file.write('#%PAM-1.0\n')
+ tmp_file.write('# -----BEGIN PAM BACKUP-----\n')
+ tmp_file.write('# Hash: ' + sha512sum + '\n')
+ tmp_file.write('# \n')
+ tmp_file.write('# Data: ' + base64enc + '\n')
+ tmp_file.write('# -----END PAM BACKUP-----\n')
+ tmp_file.write('\n')
+
+ tmp_file.close()
+
+ pam_config_setup(pam_config)
+
+ shutil.move(pam_config_path + '.sss_tmp', pam_config_path)
+
+ if len(pam_config_path + status_msg) > columns:
+ print(pam_config_path)
+ print(('{:>%is} ' % columns + 2).format(status_msg))
+ else:
+ print((' {:<%is}{:>%is} ' % \
+ (len(pam_config_path), columns - len(pam_config_path))). \
+ format(pam_config_path, status_msg))
+
+ if os.path.exists(PAM_CONFIG_DIR + 'sss'):
+ print('%ssss already exists. Moving it to %ssss.bak' % \
+ (PAM_CONFIG_DIR, PAM_CONFIG_DIR))
+ shutil.move(PAM_CONFIG_DIR + 'sss', PAM_CONFIG_DIR + 'sss.bak')
+
+ pam_sss = open(PAM_CONFIG_DIR + 'sss', 'w')
+ # Auth
+ pam_sss.write("auth sufficient pam_unix.so nullok try_first_pass\n")
+ pam_sss.write("auth sufficient pam_sss.so use_first_pass\n")
+ pam_sss.write("auth required pam_deny.so\n")
+ # Account
+ pam_sss.write("account required pam_unix.so\n")
+ pam_sss.write("#account [default=bad success=ok user_unknown=ignore] pam_sss.so\n")
+ pam_sss.write("account optional pam_sss.so\n")
+ # Password
+ pam_sss.write("password sufficient pam_unix.so try_first_pass nullok sha512 shadow\n")
+ pam_sss.write("password sufficient pam_sss.so use_authtok\n")
+ pam_sss.write("password required pam_deny.so\n")
+ # Session
+ pam_sss.write("session required pam_unix.so\n")
+ pam_sss.write("session optional pam_sss.so\n")
+ pam_sss.close()
+
+def pam_disable_sss():
+ print('Disabling sssd support in:')
+
+ rows, columns = os.popen('stty size', 'r').read().split()
+ columns = int(columns) - 3
+
+ for fullpath, directories, files in os.walk(PAM_CONFIG_DIR):
+ files.sort()
+ for pam_config in files:
+ if pam_config == 'sss' or pam_config == 'sss.bak' or \
+ pam_config.startswith('.') or pam_config.endswith('~'):
+ continue
+
+ status, sha512sum, base64enc = pam_check_header(pam_config)
+ if status == 'NONE':
+ status_msg = 'already disabled (skipping)'
+ elif status == 'VALID':
+ status_msg = 'done'
+ elif status == 'INVALID':
+ status_msg = 'invalid backup header (skipping)'
+
+ pam_config_path = PAM_CONFIG_DIR + pam_config
+
+ if status == 'VALID':
+ pam_file = open(pam_config_path + '.sss_tmp', 'wb')
+ pam_file.write(base64.b64decode(base64enc))
+ pam_file.close()
+ shutil.move(pam_config_path + '.sss_tmp', pam_config_path)
+
+ if len(pam_config_path + status_msg) > columns:
+ print(pam_config_path)
+ print(('{:>%is} ' % columns + 2).format(status_msg))
+ else:
+ print((' {:<%is}{:>%is} ' % \
+ (len(pam_config_path), columns - len(pam_config_path))). \
+ format(pam_config_path, status_msg))
+
+ if os.path.exists(PAM_CONFIG_DIR + 'sss'):
+ os.remove(PAM_CONFIG_DIR + 'sss')
+
+def parse_arguments():
+ import argparse
+ import textwrap
+
+ arg_parser = argparse.ArgumentParser()
+ arg_parser.formatter_class = argparse.RawDescriptionHelpFormatter
+ arg_parser.description = textwrap.dedent("""
+ Arch Linux sssd authentication setup helper for PAM and NSS
+ -----------------------------------------------------------
+ """)
+
+ nss_group = arg_parser.add_mutually_exclusive_group()
+ nss_group.add_argument("--enable-nss",
+ help="Enable support for SSSD in NSS",
+ action="store_true",
+ dest="nss_action",
+ default=None)
+ nss_group.add_argument("--disable-nss",
+ help="Disable support for SSSD in NSS",
+ action="store_false",
+ dest="nss_action",
+ default=None)
+
+ pam_group = arg_parser.add_mutually_exclusive_group()
+ pam_group.add_argument("--enable-pam",
+ help="Enable support for SSSD in PAM",
+ action="store_true",
+ dest="pam_action",
+ default=None)
+ pam_group.add_argument("--disable-pam",
+ help="Disable support for SSSD in PAM",
+ action="store_false",
+ dest="pam_action",
+ default=None)
+
+ args = arg_parser.parse_args()
+
+ if args.nss_action == None and args.pam_action == None:
+ print("No action given!")
+ exit(1)
+
+ if os.getuid() != 0:
+ print("sss-auth-setup must be run as root!")
+ exit(1)
+
+ if args.nss_action != None:
+ if args.nss_action:
+ nss_enable_sss()
+ else:
+ nss_disable_sss()
+
+ if args.pam_action != None:
+ if args.pam_action:
+ pam_enable_sss()
+ else:
+ pam_disable_sss()
+
+if __name__ == "__main__":
+ parse_arguments()